Partnering with Mozilla to Improve Firefox's Security

Source: Anthropic (Mar 6, 2026) Core Finding: AI models (Claude Opus 4.6) can now independently identify high-severity software vulnerabilities at unprecedented speed, demonstrating a significant advancement in AI-enabled cybersecurity.

Key Findings & Results

• Vulnerability Discovery: In a two-week collaboration, Claude Opus 4.6 discovered 22 vulnerabilities in Firefox.
• Severity: Mozilla assigned 14 of these as high-severity, representing almost a fifth (≈20%) of all high-severity Firefox vulnerabilities remediated in 2025.
• Scale: The AI scanned nearly 6,000 C++ files and submitted 112 unique reports in total.
• Speed: The first vulnerability (a Use After Free bug) was found after just 20 minutes of exploration. While the team validated and submitted this first bug, Claude had already discovered 50 more unique crashing inputs.
• Impact: Most issues were fixed in Firefox 148.0, with the remainder slated for upcoming releases.

"AI is making it possible to detect severe security vulnerabilities at highly accelerated speeds."

Process & Collaboration Model

1. Motivation: Anthropic built a dataset of prior Firefox CVEs to create a harder, more realistic evaluation for their models after Claude nearly solved the CyberGym benchmark.
2. Initial Testing: Claude Opus 4.6 successfully reproduced a high percentage of historical CVEs, prompting a test for novel vulnerabilities in the current Firefox version.
3. Focus Area: Started with Firefox's JavaScript engine due to its independent, critical nature and wide attack surface.
4. Validation & Reporting: Anthropic researchers independently validated bugs before filing reports in Mozilla's Bugzilla, including descriptions and Claude-generated patches.
5. Mozilla Partnership: Mozilla researchers encouraged bulk submission of findings, even without full validation of each crash's security implications. This transparent triage process was key to the collaboration's success.

Technical Insights & Exploit Development

• Exploitation Capability: To test limits, Claude was tasked with creating exploits for the discovered vulnerabilities. It successfully created crude, working exploits in only 2 out of several hundred attempts (costing ~$4,000 in API credits).
• Key Insight: Claude is significantly better at finding vulnerabilities than exploiting them. The cost of identification is an order of magnitude cheaper than exploit development.
• Defense in Depth: The successful exploits only worked in a test environment without modern browser security features like the sandbox. Firefox's layered defenses would have mitigated these attacks in practice.

Best Practices & Future Implications

For AI-Enabled Security Research:

• Task Verifiers: Use trusted tools to confirm an AI agent's output achieves its goal (e.g., verifying a patch removes the bug and doesn't break functionality). This dramatically improves output quality.
• Submission Standards: To build trust with maintainers, reports should include:
  1. Minimal test cases
  2. Detailed proofs-of-concept
  3. Candidate patches
• Coordinated Vulnerability Disclosure (CVD): Anthropic has published its operating principles, following industry norms but prepared to adapt as AI capabilities advance.

The Urgency & Path Forward:

• Defender's Advantage: Currently, frontier models are far better at finding and fixing vulnerabilities than exploiting them, giving defenders a critical window.
• Call to Action: Developers are urged to redouble security efforts now, before the gap between discovery and exploitation abilities closes.
• Anthropic's Plans: They will expand cybersecurity efforts, including:
  • Working with developers to find vulnerabilities via CVD.
  • Developing tools to help maintainers triage reports.
  • Directly proposing patches.
  • Releasing Claude Code Security (in limited research preview) to bring these capabilities to customers and maintainers.

"Frontier language models are now world-class vulnerability researchers."

Footnotes:

1. Advice is based on Claude but applicable to other LLMs.
2. Mozilla patched the vulnerabilities independently.